The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58928 advisory.

    * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory     (CVE-2026-11940)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1655:20 advisory.

    * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory     (CVE-2026-11940)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:63117 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory     (CVE-2026-11940)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1670:21 advisory.

    * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory     (CVE-2026-11940)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1673:06 advisory.

    * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory     (CVE-2026-11940)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.25-10.el9 build changelog.

  - tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a     hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback     validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting     a relative target the filter judged contained escape the destination directory. This allowed a malicious     tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads     or writes. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9f0296a41 advisory.

    A security update of the Python interpreter.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7de2b1cfc5 advisory.

    A security update of the Python interpreter

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    unicodedata.normalize() can take excessive CPU time when processing_x000D_     specially crafted Unicode input containing long runs of combining characters_x000D_     with alternating Canonical Combining Class values._x000D_     This affects all normalization forms.(CVE-2026-3276)

    tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a     hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback     validated the symlink at its archived location but recreated it at the hardlink's shallower path, letting     a relative target the filter judged contained escape the destination directory. This allowed a malicious     tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads     or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    When calling base64.b64decode() or related functions the decoding process would stop after encountering     the first padded quad regardless of whether there was more information to be processed. This can lead to     data being accepted which may be processed differently by other implementations. Use 'validate=True' to     enable stricter processing of base64 data.(CVE-2026-3446)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

    The imaplib module, when passed a user-controlled command, can have additional commands injected using     newlines. Mitigation rejects commands containing control characters.(CVE-2025-15366)

    To allow builds of Python to be run from an in-tree layout (rather than_x000D_     an installed file layout), the VPATH variable is defined at build time_x000D_     and used to locate certain landmarks - specifically,_x000D_     Modules/setup.local. When this landmark is found relative to VPATH_x000D_     relative to the executable, Python assumes it is running in a source_x000D_     tree and generates a different default sys.path. This code remains in_x000D_     release builds, so that release-ready builds can be built in-tree._x000D_
    _x000D_     On Windows, since builds are written to 'PCbuild/', the value of_x000D_     VPATH is set to '..\..', which results in a landmark of_x000D_     '..\..\Modules\setup.local'. This path is outside the install directory_x000D_     of Python, and may have different permissions, potentially allowing a_x000D_     low-privilege user to create the landmark and an alternative `Lib`_x000D_     folder that will be discovered by an otherwise restricted install._x000D_
    _x000D_     Such a setup occurs with the legacy default install location for all_x000D_     users (in the now superseded EXE installer), due to how Windows allows_x000D_     all users to create folders in the root directory of their OS drive._x000D_
    _x000D_     Our recommended mitigation on Windows is to migrate away from the_x000D_     legacy installer and use the new [Python install_x000D_     manager](https://www.python.org/downloads/latest/pymanager/) to install_x000D_     for the current user. Installs where the directory two levels above the_x000D_     Python installation directory have equivalent permissions are unaffected_x000D_     (in general, a per-user install cannot be modified at all by other_x000D_     users, removing any escalation of privilege risk, and could be directly_x000D_     modified by a privileged user, making the potential tampering_x000D_     irrelevant). Alternative mitigations might include preemptively creating_x000D_     and restricting access to a `Modules` directory. Be aware that only 3.13_x000D_     and 3.14 will receive updated legacy installers - earlier fixes are only_x000D_     provided as sources._x000D_
    _x000D_     Platforms other than Windows allow VPATH to be overridden, but as they_x000D_     don't usually use a separated directory in the build for binaries, are_x000D_     unlikely to have a landmark reference outside of the install directory._x000D_
    _x000D_     The landmark detection involving VPATH is a fallback for when a more_x000D_     specific landmark - .\pybuilddir.txt - is absent, and was included for_x000D_     compatibility. Future releases of Python will no longer include the_x000D_     fallback, and so builds will need to generate or preserve the_x000D_     pybuilddir.txt file in order to work in-tree. This landmark file has_x000D_     been generated on Windows since 3.11, and on other platforms for longer.(CVE-2026-12003)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    When using the 'configparser' module to write configuration files_x000D_     containing multi-line text values with carriage return characters (\r) the_x000D_     resulting file could be injected with unexpected keys and values if the_x000D_     attacker controls the written value.(CVE-2026-0864)

    When using the 'tarfile' module with a file opened in 'streaming mode' (mode='r|') the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

    The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities     addressed in third party software that is included in Oracle Solaris distributions. Starting January 20,     2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released.
    These bulletins will also be updated after their release between the quarterly Critical Patch Updates. In     addition, Third Party Bulletins may also be updated for vulnerability issues deemed too critical to wait     for the next monthly update.(CVE-2026-8328)

    The incremental HTML parser (html.parser.HTMLParser) allows for CPU_x000D_     denial-of-service through repeated unterminated markup declarations when_x000D_     processing uncontrolled data.(CVE-2026-15308)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values.This     affects all normalization forms.(CVE-2026-3276)

    tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a     hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback     validated the symlink at its archived location but recreated it at the hardlink's shallower path, letting     a relative target the filter judged contained escape the destination directory. This allowed a malicious     tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads     or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    When calling base64.b64decode() or related functions the decoding process would stop after encountering     the first padded quad regardless of whether there was more information to be processed. This can lead to     data being accepted which may be processed differently by other implementations. Use 'validate=True' to     enable stricter processing of base64 data.(CVE-2026-3446)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

    The imaplib module, when passed a user-controlled command, can have additional commands injected using     newlines. Mitigation rejects commands containing control characters.(CVE-2025-15366)

    To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the     VPATH variable is defined at build time and used to locate certain landmarks -     specifically,Modules/setup.local. When this landmark is found relative to VPATH     relative to the executable, Python assumes it is running in a source tree and generates a different     default sys.path. This code remains in release builds, so that release-ready builds can be built in-     tree.On Windows, since builds are written to 'PCbuild/', the value of     VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside     the install directory of Python, and may have different permissions, potentially allowing a low-privilege     user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise     restricted install.Such a setup occurs with the legacy default install location for all users (in the now     superseded EXE installer), due to how Windows allows all users to create folders in the root directory of     their OS drive.Our recommended mitigation on Windows is to migrate away from the legacy installer and use     the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the     current user. Installs where the directory two levels above the     Python installation directory have equivalent permissions are unaffected (in general, a per-user install     cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly     modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might     include preemptively creating and restricting access to a `Modules` directory. Be aware that only 3.13 and     3.14 will receive updated legacy installers - earlier fixes are only provided as sources.Platforms other     than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the     build for binaries, are unlikely to have a landmark reference outside of the install directory.The     landmark detection involving VPATH is a fallback for when a more     specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of     Python will no longer include the fallback, and so builds will need to generate or preserve the     pybuilddir.txt file in order to work in-tree. This landmark file has     been generated on Windows since 3.11, and on other platforms for longer.(CVE-2026-12003)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    When using the 'configparser' module to write configuration files containing multi-line text values with     carriage return characters (\r) the resulting file could be injected with unexpected keys and values if     the attacker controls the written value.(CVE-2026-0864)

    When using the 'tarfile' module with a file opened in 'streaming mode' (mode='r|') the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

    The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities     addressed in third party software that is included in Oracle Solaris distributions. Starting January 20,     2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released.
    These bulletins will also be updated after their release between the quarterly Critical Patch Updates. In     addition, Third Party Bulletins may also be updated for vulnerability issues deemed too critical to wait     for the next monthly update.(CVE-2026-8328)

    The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated     unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

    tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a     hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback     validated the symlink at its archived location but recreated it at the hardlink's shallower path, letting     a relative target the filter judged contained escape the destination directory. This allowed a malicious     tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads     or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    When an Expat parser with a registered ElementDeclHandler parses an inline     document type definition containing a deeply nested content model a C stack     overflow occurs.(CVE-2026-4224)

    http.cookies.Morsel.js_output() returns an inline script snippet and only escapes ' for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence /script inside the     generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie     value.(CVE-2026-6019)

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and     `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-     used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the     dangling pointer in this specific error condition.

    The vulnerability is only present if the program re-uses decompressor instances across multiple     decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions     to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and     `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor     instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

    The webbrowser.open() API would accept leading dashes in the URL which     could be handled as command line options for certain web browsers. New     behavior rejects leading dashes. Users are recommended to sanitize URLs     prior to passing to webbrowser.open().(CVE-2026-4519)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.(CVE-2026-2297)

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().(CVE-2026-3644)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

    tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a     hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback     validated the symlink at its archived location but recreated it at the hardlink's shallower path, letting     a relative target the filter judged contained escape the destination directory. This allowed a malicious     tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads     or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    When an Expat parser with a registered ElementDeclHandler parses an inline document type definition     containing a deeply nested content model a C stack overflow occurs.(CVE-2026-4224)

    http.cookies.Morsel.js_output() returns an inline script snippet and only escapes ' for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence /script inside the     generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie     value.(CVE-2026-6019)

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and     `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-     used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the     dangling pointer in this specific error condition.The vulnerability is only present if the program re-uses     decompressor instances across multiple decompression calls even after a `MemoryError` is raised during     decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`,     `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor     instance is used per call. If the decompressor instance is not re-used after an error condition, this     usage is similarly not vulnerable.(CVE-2026-6100)

    The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line     options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize     URLs prior to passing to  webbrowser.open().(CVE-2026-4519)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.(CVE-2026-2297)

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().(CVE-2026-3644)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using     XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag     siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such     as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.(CVE-2026-6879)

    In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
    An affected system that extracts content from untrusted tar files could end up writing files with an     unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

    The ftpcp() function in Lib/ftplib.py was not updated when     CVE-2021-4189 was fixed. While makepasv() was patched to replace     server-supplied PASV host addresses with the actual peer address     (getpeername()[0]), ftpcp() still calls parse227() directly and passes     the raw attacker-controllable IP address and port to target.sendport(). This patch is related to     CVE-2021-4189.(CVE-2026-8328)

    unicodedata.normalize() can take excessive CPU time when processing     specially crafted Unicode input containing long runs of combining characters     with alternating Canonical Combining Class values.
    This affects all normalization forms.(CVE-2026-3276)

    When using the 'configparser' module to write configuration files     containing multi-line text values with carriage return characters (\r) the     resulting file could be injected with unexpected keys and values if the     attacker controls the written value.(CVE-2026-0864)

    When using the 'tarfile' module with a file opened in 'streaming mode' (mode='r|') the tarfile module did     not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

    tarfile.extractall() with the 'data' or 'tar'      filter could be bypassed by a crafted archive where a hardlink     references a symlink stored at a deeper name than the hardlink itself.
    The extraction fallback validated the symlink at it's archived location     but recreated it at the hardlink's shallower     path, letting a relative      target the filter judged contained escape the destination directory.
    This allowed a malicious tar archive to create a symlink pointing     outside the destination, enabling out-of-destination file reads or     writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

    http.cookies.Morsel.js_output() returns an inline script snippet and only escapes ' for JavaScript     string context. It does not neutralize the HTML parser-sensitive sequence /script inside the     generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie     value.(CVE-2026-6019)

    Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and     `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-     used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the     dangling pointer in this specific error condition.

    The vulnerability is only present if the program re-uses decompressor instances across multiple     decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions     to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and     `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor     instance is not re-used after an error condition, this usage is similarly not vulnerable.(CVE-2026-6100)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data.(CVE-2026-9669)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process.(CVE-2026-7774)

    The webbrowser.open() API would accept leading dashes in the URL which     could be handled as command line options for certain web browsers. New     behavior rejects leading dashes. Users are recommended to sanitize URLs     prior to passing to webbrowser.open().(CVE-2026-4519)

    The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled     in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers     for this audit event therefore do not fire.(CVE-2026-2297)

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The     Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass     input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to     BaseCookie.output().(CVE-2026-3644)

    When an Expat parser with a registered ElementDeclHandler parses an inline     document type definition containing a deeply nested content model a C stack     overflow occurs.(CVE-2026-4224)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
339413	RockyLinux 10 : python3.14 (RLSA-2026:58928)	Nessus	Rocky Linux Local Security Checks	2026/8/25	2026/8/25	high
339655	MiracleLinux 8 : python3.12-3.12.14-1.el8_10 (AXSA:2026-1655:20)	Nessus	Miracle Linux Local Security Checks	2026/8/26	2026/8/26	high
342747	RHEL 9 : python3.12 (RHSA-2026:63117)	Nessus	Red Hat Local Security Checks	2026/9/4	2026/9/4	high
340987	MiracleLinux 9 : python3.12-3.12.14-1.el9_8 (AXSA:2026-1670:21)	Nessus	Miracle Linux Local Security Checks	2026/8/27	2026/8/27	high
340989	MiracleLinux 9 : python3.14-3.14.7-2.el9_8 (AXSA:2026-1673:06)	Nessus	Miracle Linux Local Security Checks	2026/8/27	2026/8/27	high
337900	CentOS 9 : python3.9-3.9.25-10.el9	Nessus	CentOS Local Security Checks	2026/8/19	2026/8/19	high
337895	Fedora 44 : python3.12 (2026-a9f0296a41)	Nessus	Fedora Local Security Checks	2026/8/19	2026/8/19	high
339692	Fedora 43 : python3.12 (2026-7de2b1cfc5)	Nessus	Fedora Local Security Checks	2026/8/26	2026/8/26	high
364019	EulerOS 2.0 SP15 : python3 (EulerOS-SA-2026-4012)	Nessus	Huawei Local Security Checks	2026/10/8	2026/10/15	high
377206	EulerOS Virtualization 2.15.1 : python3 (EulerOS-SA-2026-4790)	Nessus	Huawei Local Security Checks	2026/11/7	2026/11/7	high
343718	EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-3305)	Nessus	Huawei Local Security Checks	2026/9/8	2026/9/8	critical
347223	EulerOS Virtualization 2.12.1 : python3 (EulerOS-SA-2026-3609)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	critical
364930	EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-4373)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

critical

critical

critical